Merge remote-tracking branch 'origin/main' into ml-df

* origin/main: (43 commits)
  chore(deps): update golang:1.25.3 docker digest to bce1e7e (#1382)
  Clean before regenerating the client
  Clean before regenerating the client
  Use a working API spec
  chore(deps): update kibana-openapi-spec digest to 9b8ef82 (#1377)
  Include the generated client in the post upgrade task
  Reliably run acceptance tests in Kibana client buildkite pipeline (#1378)
  Test older runner (#1380)
  Fixup file match
  chore(deps): update golang docker tag to v1.25.3 (#1369)
  Add post upgrade tasks for Kibana client
  Allow free text for Elasticsearch role mapping names (#1373)
  Use an image with Golang and Terraform
  Run acceptance tests
  Remove postUpgradeTasks from renovate
  chore(deps): pin docker.elastic.co/ci-agent-images/mis-terraform docker tag to 2fae26c (#1371)
  Synthetics tidy (#1370)
  Use terraform build image
  Bump agent resources
  Don't trigger on PR
  ...

Author: tobio

.buildkite/hooks/pre-command

@@ -2,6 +2,11 @@
 
 set -euo pipefail
 
+if [[ "${BUILDKITE_PIPELINE_SLUG}" != "terraform-provider-elasticstack-release" ]]; then
+  echo "Skipping pre-command hook for non-release pipeline"
+  exit 0
+fi
+
 RELEASE_VAULT_PATH=kv/ci-shared/terraform-providers
 
 if [[ "$BUILDKITE_PIPELINE_SLUG" == "terraform-provider-elasticstack-release" ]]; then

.buildkite/release.yml

@@ -1,7 +1,7 @@
 steps:
   - label: Release
     agents:
-      image: "golang:1.25.1@sha256:8305f5fa8ea63c7b5bc85bd223ccc62941f852318ebfbd22f53bbd0b358c07e1"
+      image: "golang:1.25.3@sha256:bce1e7ec780444d85d041889e7a0e542b0be7b272a7f46a5fb947f0f484b9736"
       cpu: "16"
       memory: "24G"
       ephemeralStorage: "20G"

.buildkite/scripts/update-kibana-client.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source /etc/profile.d/go.sh
+
+echo "--- Regenerating the Kibana client"
+make -C generated/kbapi all
+
+echo "--- Building the provider"
+make build
+
+echo "--- Starting Stack containers"
+make docker-fleet
+docker ps 
+sleep 30
+
+echo "--- Collecting docker info"
+docker ps 
+docker logs terraform-elasticstack-kb 2>&1 > kibana.log
+docker logs terraform-elasticstack-es 2>&1 > es.log
+docker logs terraform-elasticstack-fleet 2>&1 > fleet.log
+
+buildkite-agent artifact upload kibana.log
+buildkite-agent artifact upload es.log
+buildkite-agent artifact upload fleet.log
+
+echo "--- Running acceptance tests"
+ELASTICSEARCH_ENDPOINTS=http://localhost:9200 KIBANA_ENDPOINT=http://localhost:5601 ELASTICSEARCH_USERNAME=elastic ELASTICSEARCH_PASSWORD=password make testacc

.buildkite/update-kibana-client.yml

@@ -0,0 +1,8 @@
+agents:
+  provider: "gcp"
+  machineType: "n1-standard-4"
+  image: family/terraform-provider-elasticstack-ubuntu-2204
+steps:
+  - label: Regenerate Kibana client and build provider
+    command:
+      - ".buildkite/scripts/update-kibana-client.sh"

.github/workflows/test.yml

@@ -50,7 +50,7 @@ jobs:
   test:
     name: Matrix Acceptance Test
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner == 'ubuntu-22.04' && 'ubuntu-22.04' || 'ubuntu-latest' }}
     env:
       ELASTIC_PASSWORD: password
       KIBANA_SYSTEM_USERNAME: kibana_system
@@ -108,11 +108,6 @@ jobs:
       matrix:
         version:
           - '7.17.13'
-          - '8.0.1'
-          - '8.1.3'
-          - '8.2.3'
-          - '8.3.3'
-          - '8.4.3'
           - '8.5.3'
           - '8.6.2'
           - '8.7.1'
@@ -130,6 +125,17 @@ jobs:
           - '8.19.3'
           - '9.0.7'
           - '9.1.3'
+        include:
+          - version: '8.0.1'
+            runner: ubuntu-22.04
+          - version: '8.1.3'
+            runner: ubuntu-22.04
+          - version: '8.2.3'
+            runner: ubuntu-22.04
+          - version: '8.3.3'
+            runner: ubuntu-22.04
+          - version: '8.4.3'
+            runner: ubuntu-22.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6

CHANGELOG.md

@@ -1,5 +1,53 @@
 ## [Unreleased]
 
+- Fix regression restricting the characters in an `elasticstack_elasticsearch_role_mapping` `name`. ([#1373](https://github.com/elastic/terraform-provider-elasticstack/pull/1373))
+
+## [0.12.0] - 2025-10-15
+
+- Fix provider crash with `elasticstack_kibana_action_connector` when `config` or `secrets` was unset in 0.11.17 ([#1355](https://github.com/elastic/terraform-provider-elasticstack/pull/1355))
+- Added `labels` field to `elasticstack_kibana_synthetics_monitor` resource for associating key-value pairs with monitors ([#1360](https://github.com/elastic/terraform-provider-elasticstack/pull/1360))
+- Fixes provider crash with `elasticstack_kibana_slo` when using `kql_custom_indicator` with no `filter` set. ([#1354](https://github.com/elastic/terraform-provider-elasticstack/pull/1354))
+- Updates for Security Detection Rules ([#1361](https://github.com/elastic/terraform-provider-elasticstack/pull/1361)
+  - Add support for `threat` property
+  - Gracefully support `query` property not being set
+  - Add esql specific validations to reject unsupported fields `index` and `filters`
+  - Gracefully handle response action with no provided `frequency`
+  - Add validation for required `anomaly_threshold` field in anomaly detection rules
+  - Add support for `timeline_id` / `timeline_title` fields
+  - Gracefully handle `threat_query` not being provided for `threat_match` ule
+
+## [0.11.18] - 2025-10-10
+
+### Breaking changes
+
+The `ssl` field on the `elasticstack_fleet_output` resource has been changes from a block to an attribute. This change ensures ongoing consistency within the resource schema for this resource, and aligns with Terraform best practices. 
+
+Existing `elasticstack_fleet_output` resources defining `ssl` will have to update the declaration to an attribute style. For example: 
+
+```hcl
+resource "elasticstack_fleet_output" "output" {
+  ...
+  ssl {
+    ...
+  }
+}
+```
+
+becomes 
+
+```hcl
+resource "elasticstack_fleet_output" "output" {
+  ...
+  ssl = {  # Note the equals sign here. 
+    ...
+  }
+}
+```
+
+### Changes
+
+- Create `elasticstack_kibana_security_detection_rule` resource. ([#1290](https://github.com/elastic/terraform-provider-elasticstack/pull/1290))
+- Add `elasticstack_kibana_export_saved_objects` data source ([#1293](https://github.com/elastic/terraform-provider-elasticstack/pull/1293))
 - Create `elasticstack_kibana_maintenance_window` resource. ([#1224](https://github.com/elastic/terraform-provider-elasticstack/pull/1224))
 - Add support for `solution` field in `elasticstack_kibana_space` resource and data source ([#1102](https://github.com/elastic/terraform-provider-elasticstack/issues/1102))
 - Add `slo_id` validation to `elasticstack_kibana_slo` ([#1221](https://github.com/elastic/terraform-provider-elasticstack/pull/1221))
@@ -21,6 +69,7 @@
 - Add support for `unenrollment_timeout` in `elasticstack_fleet_agent_policy` ([#1169](https://github.com/elastic/terraform-provider-elasticstack/issues/1169))
 - Handle default value for `allow_restricted_indices` in `elasticstack_elasticsearch_security_api_key` ([#1315](https://github.com/elastic/terraform-provider-elasticstack/pull/1315))
 - Fixed `nil` reference in kibana synthetics API client in case of response errors ([#1320](https://github.com/elastic/terraform-provider-elasticstack/pull/1320))
+- Add support for `agent_policy_ids` in `elasticstack_fleet_integration_policy` ([#1131](https://github.com/elastic/terraform-provider-elasticstack/pull/1311))
 
 ## [0.11.17] - 2025-07-21
 
@@ -458,7 +507,9 @@
 - Initial set of docs
 - CI integration
 
-[Unreleased]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.17...HEAD
+[Unreleased]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.12.0...HEAD
+[0.11.18]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.18...v0.12.0
+[0.11.18]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.17...v0.11.18
 [0.11.17]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.16...v0.11.17
 [0.11.16]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.15...v0.11.16
 [0.11.15]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.14...v0.11.15

Makefile

@@ -1,7 +1,7 @@
 .DEFAULT_GOAL = help
 SHELL := /bin/bash
 
-VERSION ?= 0.11.17
+VERSION ?= 0.12.0
 
 NAME = elasticstack
 BINARY = terraform-provider-${NAME}
@@ -54,7 +54,7 @@ build: lint build-ci ## build the terraform provider
 
 .PHONY: testacc
 testacc: ## Run acceptance tests
-	TF_ACC=1 go test -v ./... -count $(ACCTEST_COUNT) -parallel $(ACCTEST_PARALLELISM) $(TESTARGS) -timeout $(ACCTEST_TIMEOUT)
+	TF_ACC=1 go tool gotestsum --format testname --rerun-fails=3 --packages="-v ./..." -- -count $(ACCTEST_COUNT) -parallel $(ACCTEST_PARALLELISM) $(TESTARGS) -timeout $(ACCTEST_TIMEOUT)
 
 .PHONY: test
 test: ## Run unit tests
@@ -245,7 +245,7 @@ install: build ## Install built provider into the local terraform cache
 
 .PHONY: tools
 tools: $(GOBIN)  ## Download golangci-lint locally if necessary.
-	@[[ -f $(GOBIN)/golangci-lint ]] || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) v2.4.0
+	@[[ -f $(GOBIN)/golangci-lint ]] || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) v2.5.0
 
 .PHONY: golangci-lint
 golangci-lint:

catalog-info.yaml

@@ -35,3 +35,42 @@ spec:
           access_level: MANAGE_BUILD_AND_READ
         everyone:
           access_level: READ_ONLY
+
+---
+# yaml-language-server: $schema=https://gist.githubusercontent.com/elasticmachine/988b80dae436cafea07d9a4a460a011d/raw/e57ee3bed7a6f73077a3f55a38e76e40ec87a7cf/rre.schema.json
+apiVersion: backstage.io/v1alpha1
+kind: Resource
+metadata:
+  name: buildkite-pipeline-tf-provider-elasticstack-update-kibana
+  description: Buildkite Pipeline for updating Kibana client in Terraform provider Elasticstack
+  links:
+    - title: Pipeline
+      url: https://buildkite.com/elastic/terraform-provider-elasticstack-update-kibana-client
+
+spec:
+  type: buildkite-pipeline
+  owner: group:control-plane-hosted-applications
+  system: buildkite
+  implementation:
+    apiVersion: buildkite.elastic.dev/v1
+    kind: Pipeline
+    metadata:
+      name: terraform-provider-elasticstack / Update Kibana client
+      description: Terraform provider Elasticstack - update Kibana client
+    spec:
+      repository: elastic/terraform-provider-elasticstack
+      pipeline_file: ".buildkite/update-kibana-client.yml"
+      provider_settings:
+        build_branches: false
+        build_pull_requests: false
+        build_pull_request_labels_changed: false
+        build_pull_request_ready_for_review: false
+        build_pull_request_forks: false
+        build_tags: false
+      teams:
+        control-plane-hosted-applications:
+          access_level: MANAGE_BUILD_AND_READ
+        serverless-core:
+          access_level: MANAGE_BUILD_AND_READ
+        everyone:
+          access_level: READ_ONLY

docs/data-sources/elasticsearch_enrich_policy.md

@@ -1,4 +1,3 @@
-
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
 page_title: "elasticstack_elasticsearch_enrich_policy Data Source - terraform-provider-elasticstack"

docs/data-sources/elasticsearch_index_template.md

@@ -1,4 +1,3 @@
-
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
 page_title: "elasticstack_elasticsearch_index_template Data Source - terraform-provider-elasticstack"